Automatically transcribes Telegram voice messages using Groq Whisper API and replies with text generated by an LLM.

This skill does what it says (sends audio to Groq for transcription and to an LLM for reply), but it contains a hardcoded Groq API key in handler.py and will use that key if you don't set GROQ_API_KEY — that can cause your audio to be processed under someone else's account, lead to privacy concerns, and allow the author to incur or track usage. Before installing: (1) Inspect and remove the hardcoded key or require the skill to raise an error if GROQ_API_KEY is missing; (2) Preferably replace the default with no fallback and set your own GROQ_API_KEY in a secure env/store; (3) If you accidentally used the embedded key for testing, assume it is compromised and do not send sensitive audio; (4) Check Groq account logs/billing for unexpected activity and rotate any keys that were exposed; (5) Consider running the skill in a sandboxed environment and review network traffic if you need higher assurance. If the author cannot justify why a default key is embedded, treat that as a blocker to trusting this skill.

Type: OpenClaw Skill Name: groq-voice-transcriber Version: 1.0.0 The skill contains a hardcoded Groq API key in handler.py ('gsk_vXSZ...'), which is a significant security vulnerability involving credential exposure. While the code logic and SKILL.md instructions appear to align with the stated purpose of transcribing Telegram voice messages, the inclusion of a plaintext secret is a high-risk practice that could lead to unauthorized API usage or account compromise.